Changeset 704 for trunk/phpbms/modules/bms/clients_email.php

Timestamp:

01/01/10 23:10:02 (2 years ago)

Author:

brieb

Message:

• Fixed several SQL injection vulnerabilities
• Fixed several XSS vulnerabilities due to PHP_SELF and REQUREST_URI
• Fixed severa path disclosure errors

Files:

• trunk/phpbms/modules/bms/clients_email.php (modified) (11 diffs)

trunk/phpbms/modules/bms/clients_email.php

@@ -1 @@
-<?php 
+<?php
 /*
  $Rev$ | $LastChangedBy$
@@ -41 +41 @@
 
         include("./include/clients_email_include.php");
-        
-        
+
+
         $thecommand="showoptions";
         if(isset($_POST["command"])) $thecommand=$_POST["command"];
-        
+
         switch($thecommand){
                 case "send email":
@@ -54 +54 @@
                                         foreach($_SESSION["emailids"] as $id)
                                                 $whereclause.="clients.id=".$id." or ";
-                                        $whereclause=substr($whereclause,0,strlen($whereclause)-3);                                     
+                                        $whereclause=substr($whereclause,0,strlen($whereclause)-3);
                                 break;
                                 case "savedsearch":
@@ -64 +64 @@
                                 case "all":
                                         $whereclause="";
-                                break;                                          
+                                break;
                         }//end switch
                         //next the from:
-                        $_SESSION["massemail"]["from"]=str_replace("]",">",str_replace("[","<",$_POST["ds-email"]));                    
+                        $_SESSION["massemail"]["from"]=str_replace("]",">",str_replace("[","<",$_POST["ds-email"]));
                         $_SESSION["massemail"]["whereclause"]=$whereclause;
                         $_SESSION["massemail"]["subject"]=$_POST["subject"];
                         $_SESSION["massemail"]["body"]=$_POST["body"];
                         $_SESSION["massemail"]["savedproject"]=$_POST["pid"];
-                        
+
                         $querystatement="SELECT id,email, if(clients.lastname!=\"\",concat(clients.lastname,\", \",clients.firstname,if(clients.company!=\"\",concat(\" (\",clients.company,\")\"),\"\")),clients.company) AS name FROM clients ".$whereclause;
                         $sendqueryresult=$db->query($querystatement);
                         if(!$sendqueryresult) $error = new appError(300,"Error with: ".$querystatement);
-                        
+
                 break;
                 case "delete project":
@@ -100 +100 @@
                         $thecommand="showoptions";
                 break;
-                
+
                 case "done":
                 case "cancel":
                         goURL(APP_PATH."search.php?id=2");
-                        
+
                 break;
         }
-        
-        
+
+
         $pageTitle="Client/Prospect E-Mail";
- 
+
         $phpbms->cssIncludes[] = "pages/clientemail.css";
         $phpbms->jsIncludes[] = "modules/bms/javascript/clientemail.js";
@@ -117 +117 @@
                 //==============================================================
                 $theform = new phpbmsForm();
-                
+
                 if(is_numeric($therecord["emailfrom"]))
                         $theid=$therecord["emailfrom"];
                 else
                         $theid=0;
-                
+
                 $theinput = new inputSmartSearch($db, "email", "Pick Active User Email", $theid, "from");
                 $theform->addField($theinput);
-                
+
                 $theform->jsMerge();
                 //==============================================================
                 //End Form Elements
-                
+
                 if($therecord["emailto"]!="selected" AND $therecord["emailto"]!="all")
                         $phpbms->bottomJS[] ='thediv=getObjectFromID("showsavedsearches");thediv.style.display="block"';
@@ -135 +135 @@
                 if(!is_numeric($therecord["emailfrom"]))
                         $phpbms->bottomJS[] ='thefield=getObjectFromID("ds-email");thefield.value="'.$therecord["emailfrom"].'"';
-                
+
                 if($thecommand=="send email"){
-                
-                        $phpbms->topJS[]='              
-                        ids=new Array();                        
+
+                        $phpbms->topJS[]='
+                        ids=new Array();
                         emails=new Array();
                         names= new Array();';
-                        
+
                         while($therecord = $db->fetchArray($sendqueryresult)){
                                 $phpbms->topJS[]="ids[ids.length]=".$therecord["id"].";";
                                 $phpbms->topJS[]="names[names.length]=\"".$therecord["name"]."\";";
                                 $phpbms->topJS[]="emails[emails.length]=\"".$therecord["email"]."\";";
-                        }                       
+                        }
                 }//end if
- 
+
         include("header.php")
 
@@ -156 +156 @@
         <div class="bodyline" id="mainBG">
                 <h1 id="topTitle"><span><?php echo $pageTitle?></span></h1>
-                
-                <form action="<?php echo $_SERVER["PHP_SELF"] ?>" method="post" name="theform" id="theform">
+
+                <form action="<?php echo htmlentities($_SERVER["PHP_SELF"]) ?>" method="post" name="theform" id="theform">
         <?php if($thecommand=="showoptions") { ?>
-        
+
                 <input type="hidden" name="pid" id="pid" value="<?php echo $therecord["id"]?>" />
                 <div class="box">
-                        
+
                         <p id="toP">
-                                <label for="therecords">to</label><br />                        
+                                <label for="therecords">to</label><br />
                                 <select id="therecords" name="therecords" onchange="showSavedSearches(this);">
                                         <option value="selected" <?php if ($therecord["emailto"]=="selected") echo "selected=\"selected\""?>>e-mail addresses from selected records (<?php echo count($_SESSION["emailids"]) ?> record<?php if(count($_SESSION["emailids"])>1) echo "s"?>)</option>
                                         <option value="savedsearch" <?php if ($therecord["emailto"]!="selected" AND $therecord["emailto"]!="all") echo "selected=\"selected\""?>>e-mail addresses from saved search...</option>
-                                </select>                               
+                                </select>
                         </p>
                         <p id="showsavedsearches" >
                                 <label for="savedsearches">load e-mail addresses from saved search...</label><br />
-                                <?php showSavedSearches($db,$therecord["emailto"]); ?>                  
-                        </p>
-                        
+                                <?php showSavedSearches($db,$therecord["emailto"]); ?>
+                        </p>
+
                         <div class="fauxP" id="fromDiv"><?php  $theform->showField("email")?></div>
-                        
+
                         <p>
                                 <label for="subject">subject</label><br />
-                                <input type="text" name="subject" id="subject" maxlength="128" value="<?php echo htmlQuotes($therecord["subject"])?>"/>                 
-                        </p>
-                </div>
-                
+                                <input type="text" name="subject" id="subject" maxlength="128" value="<?php echo htmlQuotes($therecord["subject"])?>"/>
+                        </p>
+                </div>
+
                 <div class="box">
                         <p>
@@ -194 +194 @@
                         </p>
                 </div>
-                
+
                 <div class="box">
                         <div id="projectButtons">
@@ -205 +205 @@
                                 <input type="submit" name="command"     id="sendemail" value="send email" class="Buttons" />
                                 <input type="submit" name="command"     id="cancel" value="cancel" class="Buttons" />
-                                <input type="submit" name="command"     id="othercommand" value="" class="Buttons" />                           
-                        </div>
-                </div>
-                
+                                <input type="submit" name="command"     id="othercommand" value="" class="Buttons" />
+                        </div>
+                </div>
+
                 <div id="loadedprojects">
                         <p><?php showSavedProjects($db)?></p>
@@ -218 +218 @@
                 </div>
 <?php } elseif($thecommand=="send email"){?>
-                
+
                 <div id="processingWrap">
                         <div class="box">